Lightweight heuristics to retrieve parameter associations from binaries
Résumé
We present an approach to recover information on function signatures and data-flow relations from stripped binary code. Contrary to most approaches based either on static analysis or fine-grained dynamic instrumentation, we propose lightweight instrumentation and heuristics. Our goal is to get a fast and scalable pre-processing that could serve as a front-end to focus more detailed analysis of particular functions. We infer arity and parameter types, as well as a coupling relation (which we define). We are interested in particular in couples of functions with a data-flow relation, such as memory allocators. We trade-off accuracy for scalability and performance, but our experiments show that the results of the proposed heuristics can be quite accurate, even on a single random execution.